1. Evil Code and how to defend against it CSCI 4300 http://shiflett.org/php-security.pdf http://phpsec.org/projects/guide/2.html

3. Defense against form input attacks: data filtering

4. Dispatch method

5. Dispatch script example

6. Spoofed form input

7. Whitelist Input Verification

8. Whitelist Email address verification

9. Simple message board

10. Message Board Attack

11. Message Board defense Security tip: use pre-existing PHP functions; they are more efficient and less likely to contain security holes.

12. Cross-Site Request forgeries Victim has authenticated to target site T Evil site E forges a privileged request to T Forged request succeeds by virtue of victim’s authentication tokens.

13. Cross-Site Request Forgery example Target site, stox.com: Evil site, evil-hackers.org

14. CSRF defense: form tokens

15. Database Credentials Place db.inc outside of document root, so it cannot be accessed via a URL!

16. SQL injection attack <?php //get $uname and $passwd... mysql_query (“select * from user where uname=‘$uname’ and password=‘$passwd’”) Evil input: Uname = my_uname Passwd= mypassd’; delete from user where ‘a’=‘a’